JWT Login

Token-based login for scripts, integrations, and third-party connectors (e.g. SIEM/SOAR/discovery tools) that need to call the KRON PAM REST API without a browser-style session/cookie flow. Prefer this endpoint over the legacy POST /rest/login for any non-interactive/automated client.

Request Headers:

• Content-Type: application/json

Successful Response (200):

{
    "token_type": "bearer",
    "access_token": "<jwt-access-token>",
    "refresh_token": "<jwt-refresh-token>"
}

Usage:
Send the returned access_token as a Bearer token on every subsequent request:

Authorization: Bearer <access_token>

No session cookie or X-XSRF-TOKEN header is required for JWT-authenticated calls.

Invalid credentials / brute-force protection:
After repeated invalid attempts from the same client IP, the endpoint returns 429 Too Many Requests with {"error":"too_many_requests"} for a short cooldown window, then automatically allows login attempts again once the window expires. This differs from the CAPTCHA-based lockout on the legacy login flow, which a non-interactive client cannot solve — this is why scripted/automated clients should authenticate via this JWT endpoint instead of POST /rest/login.